I've been running some experiments with some isolated BitCoin clients to test for bugs or security issues. So far so good, haven't found anything worthy of discussion here, but I did come across a thought experiment, I figured I would put it out for discussion.

I understand how the core of BitCoin prevents cheating, basically you take the network combined CPU power to generate a chain that rely on math principles to prevent someone from trying to cheat due to that person needing more *corrupt* CPU power than *honest* CPU power out on the network making a direct attack against the block chain too expensive or difficult.

Has anyone thought about what happen if instead of attacking the block chain or math principles that build via CPU time and instead attacked the time itself as a way to produce a *corrupt* chain that could be fitted into the existing clients without needing to defeat all the CPU time it took to produce it? Instead of trying to throw as much CPU power at building a corrupt chain, you instead focus on cheating time to build a corrupt chain?

I don't quite understand. Do you mean preparing some chain ahead of time then feeding in a bunch of blocks when you get a valid block?

I doubt that's what you mean since the basic idea is that you can't work ahead because you need the hash from the previous block to start working ahead.

How do you cheat time?

It would be a very slow attack, but basically you grow a block chain with a small private network that is actually churning out blocks every 10 minutes (clients tweaked to go it exactly so there is never a change in difficulty) then after a lot of time (months), you'll have a organic chain that will eventually catch up with the real one and surpass it since the real chain flux around on block creation.

What you are doing is cheating the time within the real block chain to eventually surpass it with a chain that always has perfect expansion. It follows the rules of the protocol and thus when finally introduced to the clients would appear to be a perfectly valid chain from start to finish, except you would literally have 99% of all the bitcoins from your private network under your control.

I was thinking about that longest chain wins bit for a while, however, I presumed (didn't read the code) that there was some memory in the network outside of the "block tree" itself.

For example, I presumed that if at block 7000 everyone calculated the difficulty and the consensus was 250 then this would somehow be remembered as a permanent checkpoint. However, if each fork in the block chain is evaluated in its own relative terms then the vector you suggest seems potentially viable.

It would seem even more viable during two week periods where the main network is decreasing in CPU power. On average the network would be generating less than one block every 10 minutes. Towards the end of the two week period it seems possible that you could substitute your now longer chain for the shorter main one. Thereby erasing any number of transactions that you wanted.

If their is no memory across difficulty reset points, the substitution effect is magnified.

After testing this all day, this might be a real *theoretical* attack vector.

But I'm not an alarmist, this is what it would take for it to work.

Currently, everyone's client is trying to maintain a "1 block per 10 minutes" average and adjust the difficulty up and down based on how quickly blocks are being generated. The reason the attack *might* be possible is due to the fluctuation in block generation. Basically, it's chaos theory in action and this can be exploited.

What my *corrupt* network will be doing is producing a perfect 10 block per minute chain, eventually (months) it will catch up with the real block chain and have a perfect start to finish block chain that is longer than the current block chain being used by all clients. I then take these *corrupt* clients and fuse them into the public network where they have a chain that is significantly longer than what is out there, but the math is perfect from block 1 to the end and by default all the clients will accept this chain, and then they spread it to the next and next, and just like a virus, this new block chain wipes out everyone.

The key part is, as controlling the original PCs that made all those blocks, you end up controlling all the BTC in the system.

This is a very slow attack and instead of attacking with brute force of thousands of servers, you "kill softly" with only a few PCs maintaining a perfect block cadence production over time.

Thus an attack on *time* instead of CPU via chaos. The Trojan is the few PC that are growing the new corrupt network replacement.

I'm going to check the current block chain to see if such an attack is likely, I'll report back my further findings.

In the mean time, I'm not going to panic, I don't expect anyone else to either.

Interesting! Are you considering going all the way back to the genesis block?

I was presuming you would just wipe out recent transactions. That would require a shorter effort.

If I had to guess, I would say it would be hard (not impossible) to go all the way back to genesis. The reason I think so is the increasing amount of CPU power over time. Every time the difficulty increases, it is because blocks are generating faster on average than 1 per 10 min. There have been many difficulty increases, so therefore I'm guessing that on average since the launch of the system, blocks have been generated faster than 1 per 10 min. If you are trying to fix your rate at 1 per 10 minutes, it would seem you could never catch up.

Doh! I forgot you can fake time itself! That was the whole point of your title! You can generate blocks as fast as you want from your new genesis block! All you have to do is synchronize your network's fake clocks and fake transactions! You could probably wipe the whole list in days if you tried!

Woot! Nice attack!

Do the nodes not keep the alternate forks incase someone wants to extend them in a chunk later?

that is clever.Is there a way to verify that the current block chain has been generated for an agreed time period?Say it took 1 year to get to the current block length and your competing block chain only took 2 months?

Interesting! Are you considering going all the way back to the genesis block?

I was presuming you would just wipe out recent transactions. That would require a shorter effort.

If I had to guess, I would say it would be hard (not impossible) to go all the way back to genesis. The reason I think so is the increasing amount of CPU power over time. Every time the difficulty increases, it is because blocks are generating faster on average than 1 per 10 min. There have been many difficulty increases, so therefore I'm guessing that on average since the launch of the system, blocks have been generated faster than 1 per 10 min. If you are trying to fix your rate at 1 per 10 minutes, it would seem you could never catch up.

Doh! I forgot you can fake time itself! That was the whole point of your title! You can generate blocks as fast as you want from your new genesis block! All you have to do is synchronize your network's fake clocks and fake transactions! You could probably wipe the whole list in days if you tried!

Woot! Nice attack!

Do the nodes not keep the alternate forks incase someone wants to extend them in a chunk later?

I'm not sure, I'm guessing no; if my experiment was any indication since the "real" network wiped out the "fake" network once they synced up.

Think of like this, what would happen if you went back in time a few months with your client the way it is now and connected it to the network? Would everyone not see your client as "the longest chain, most up to date" and sync off of that?

that is clever.Is there a way to verify that the current block chain has been generated for an agreed time period?Say it took 1 year to get to the current block length and your competing block chain only took 2 months?

I think there was a post a while back that said the block chain was locked to say example:65,000 blocks in the new release client, but I haven't been able to find that post and didn't find anything in the source that suggested it.

That would be a way to defeat this reverse time attack up to the point of the block snapshot.

Won't work.A block can't have a timestamp earlier than the genesis block.The hash of the genesis block is hardcoded, so you can't replace that.Mainline will reject any block more than 2 hours into the future at the time it receives it.So if your block timestamps are spaced exactly 600 sec apart to stay at 1.0 difficulty, you'll be "too far into the future" long before your block chain is anywhere near as long as the real one.

That's what I was looking for. It's locked along the way with hard-coded hash values, that makes this vector of attack null.

Just because I'm lazy and don't have the code on this machine...

You're saying the hash recorded independently by each node outside the block chain? Where is the check-point hash stored and how often?

It's located in the code like this. Basically, a block is picked (in this case, the last one was 70567) and the client checks against that point forward. So if you attempt to modify the chain along the way (as what I was doing) at some point, it wouldn't match up properly and the current clients would reject it as fake.

The only attack would be to generate from the last snap-shop, but with the difficulty so high from that point, CPU time becomes too expensive.

You're saying the hash recorded independently by each node outside the block chain? Where is the check-point hash stored and how often?

Satoshi includes the hash of a recent block in the code every once in a while. It's not done by each node. Right now, all blocks up to 70,567 are protected from modification.

This isn't to prevent any particular attack, but just as a "safety net" that will allow most transactions to be preserved in any possible case. Even without the checkpoints, you would never get ahead of the real chain with this attack.

I'm not quite sure how this attack can work because it has the following pre-requisites:

1) that you can generate blocks faster than the rest of the network

2) that you can do so without being subject to the same target modification rules

As I see it, assuming you have so much processing power that you can outpace the network, when you are doing your block generation, you will still have to adjust the target using the same algorithm or when you start posting your blocks to the network, they're going to get rejected because you weren't obeying the target value rules, therefore, I don't see how you could actually permit yourself to generate blocks more cheaply by not announcing them.